0 Persons are tagged with #exploit

#exploit

scriptkiddie@anonsys.net
Script Kiddie

Trigger Bot 😱🎮

#game #gamer #cheat #software #fail #bug #chat #problem #News

♲ anonymiss - 2024-10-18 09:07:32 GMT

tl;dr: write "trigger bot" in the chat to #exploit #gaming #anticheat #software. This will result in permanently ban for the #gamer 😱- - - - - -

OVERVIEW
Signature scanning is a mechanism implemented by all modern anticheats. When used correctly, it is an effective way to catch and ban cheaters in video games.
Also antiviruses use this technique to catch and identify malware so the method is not new or fundamentally flawed.
The way signature scanning works is that it scans your computers memory for footprint of known cheat software.
This requires that the anticheat devs carefully analyze the cheat and create an UNIQUE signature that is only found in your RAM when the cheat is loaded and NEVER found when the cheat is not loaded.
RICOCHET AND SIGNATURE SCANS
As expected, Ricochet also uses signature scanning as one of its many methods of detecting and banning cheaters.
Earlier this year, when I was tracking memory allocations of their kernel module, I stumbled upon a memory region that caught my attention. Unlike most regions, this one contained
a lot of strings, all of them cheating related. Reversing the structure confirmed my suspicions; it was a list of signatures for a signature scan routine.
THE SIGNATURES
As I said before, anticheats must be extra careful when creating signatures for cheats - a bad signature could lead to innocent players being banned.
Well, without further ado, lets take a look at a few signatures Ricochet has been using:
53 63 72 65 65 6e 73 68 6f 74 20 63 6f 75 6e 74 65 72 (Screenshot counter)
54 72 69 67 67 65 72 20 42 6f 74 (Trigger Bot)
42 00 75 00 62 00 62 00 6c 00 65 00 20 00 45 00 53 00 50 00 (B.u.b.b.l.e. .E.S.P.)
As you can see, Ricochet is a big fan of using plaintext ASCII (and multibyte) strings for their signature scans. What could go wrong?
THE EXPLOIT
So now we know that anyone who has the sequence "Trigger Bot" in their games memory will be flagged as a cheater.
This might sound reasonable at first glance since "Trigger Bot" is a common occurrence in cheat menus. Surely you are using one if this phrase is found from your game, right?
Well, unfortunately for Ricochet, that's not the case. Someone sends a message in game chat, that message will be in your games memory. Someone sends you a friend request - their name will be in your games memory.
When you are playing a game, all the player names in your lobby - guess what? In your games memory.
THE IMPLICATIONS
For quite some time it has been possible to get people permanently banned by sending them a friend request or posting a message ("Nice Trigger Bot dude!") in game chat.
I even heard of someone who made an autohotkey script to spam join Warzone lobbies and post messages in chat to get anyone in the lobby banned who is scanned by Ricochet during the game (couldn't be me, honest).
I am in a position where I can say that several thousand random COD players were banned by this exploit before the streamers began to be targeted. Censor, Parasite - etc and the others were targeted before the big reveal. I planned to target more but it seems when several major streamers are perma banned, Ricochet will turn bans off and investigate. No fun. x)
This is the result of major oversight from the Ricochet team by using improper signatures.
Activision has already started to unban accounts that were banned using this exploit, but this comes with a caveat: also real cheaters who were caught by these signatures will get unbanned. Also Ricochet seems to not understand how many people got pwned by this with their small number claims. x)
You can read their statement here with highly downplays the number of false bans issued - https://x.com/CODUpdates/status/1847001212761350574

#bot #cheat #fail #bug #game #security #Problem #chat #string #trigger #news #cod

anonymiss

anonymiss@despora.de
anonymiss

tl;dr: write "trigger bot" in the chat to #exploit #gaming #anticheat #software. This will result in permanently ban for the #gamer 😱

OVERVIEW
Signature scanning is a mechanism implemented by all modern anticheats. When used correctly, it is an effective way to catch and ban cheaters in video games.
Also antiviruses use this technique to catch and identify malware so the method is not new or fundamentally flawed.
The way signature scanning works is that it scans your computers memory for footprint of known cheat software.
This requires that the anticheat devs carefully analyze the cheat and create an UNIQUE signature that is only found in your RAM when the cheat is loaded and NEVER found when the cheat is not loaded.
RICOCHET AND SIGNATURE SCANS
As expected, Ricochet also uses signature scanning as one of its many methods of detecting and banning cheaters.
Earlier this year, when I was tracking memory allocations of their kernel module, I stumbled upon a memory region that caught my attention. Unlike most regions, this one contained
a lot of strings, all of them cheating related. Reversing the structure confirmed my suspicions; it was a list of signatures for a signature scan routine.
THE SIGNATURES
As I said before, anticheats must be extra careful when creating signatures for cheats - a bad signature could lead to innocent players being banned.
Well, without further ado, lets take a look at a few signatures Ricochet has been using:
53 63 72 65 65 6e 73 68 6f 74 20 63 6f 75 6e 74 65 72 (Screenshot counter)
54 72 69 67 67 65 72 20 42 6f 74 (Trigger Bot)
42 00 75 00 62 00 62 00 6c 00 65 00 20 00 45 00 53 00 50 00 (B.u.b.b.l.e. .E.S.P.)
As you can see, Ricochet is a big fan of using plaintext ASCII (and multibyte) strings for their signature scans. What could go wrong?
THE EXPLOIT
So now we know that anyone who has the sequence "Trigger Bot" in their games memory will be flagged as a cheater.
This might sound reasonable at first glance since "Trigger Bot" is a common occurrence in cheat menus. Surely you are using one if this phrase is found from your game, right?
Well, unfortunately for Ricochet, that's not the case. Someone sends a message in game chat, that message will be in your games memory. Someone sends you a friend request - their name will be in your games memory.
When you are playing a game, all the player names in your lobby - guess what? In your games memory.
THE IMPLICATIONS
For quite some time it has been possible to get people permanently banned by sending them a friend request or posting a message ("Nice Trigger Bot dude!") in game chat.
I even heard of someone who made an autohotkey script to spam join Warzone lobbies and post messages in chat to get anyone in the lobby banned who is scanned by Ricochet during the game (couldn't be me, honest).
I am in a position where I can say that several thousand random COD players were banned by this exploit before the streamers began to be targeted. Censor, Parasite - etc and the others were targeted before the big reveal. I planned to target more but it seems when several major streamers are perma banned, Ricochet will turn bans off and investigate. No fun. x)
This is the result of major oversight from the Ricochet team by using improper signatures.
Activision has already started to unban accounts that were banned using this exploit, but this comes with a caveat: also real cheaters who were caught by these signatures will get unbanned. Also Ricochet seems to not understand how many people got pwned by this with their small number claims. x)
You can read their statement here with highly downplays the number of false bans issued - https://x.com/CODUpdates/status/1847001212761350574

#bot #cheat #fail #bug #game #security #Problem #chat #string #trigger #news #cod

One person like that
anonymiss@despora.de
anonymiss

Faulty instructions in #Alibaba's T-Head #C910 #RISC-V CPUs blow away all #security

source: https://www.theregister.com/2024/08/07/riscv_business_thead_c910_vulnerable/

When you use these flawed instructions, you will be touching physical #memory directly, bypassing the #MMU and its memory protection mechanisms that ordinarily prevent apps from interfering with each other and the underlying #OS and #hardware.

#cpu #fail #news #problem #exploit #ram

4 Likes
3 Comments
anonymiss@despora.de
anonymiss

Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit

source: https://flatt.tech/research/posts/beyond-the-limit-expanding-single-packet-race-condition-with-first-sequence-sync/

To overcome the limitation of a single packet attack, I used IP fragmentation and TCP sequence number reordering.

Using IP layer fragmentation, a single TCP packet can be split into multiple IP packets, which allows the full utilization of the TCP window size.
Additionally, by re-ordering the TCP sequence numbers, I prevented the target server from processing any of the TCP packets until I sent the final packet.

Thanks to these techniques, we can significantly exploit a minor limit-overrun vulnerability, potentially leading to severe vulnerabilities like the authentication bypass of one-time token authentication. During testing, I was able to send 10,000 requests in about 166ms.

#network #tcp #ip #internet #hack #hacker #exploit #news #software #limit #knowledge

Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. In 2023, James Kettle of PortSwigger published an excellent paper titled Smashing the state machine: the true potential of web race conditions. In the paper, he...

2 Likes
1 Shares
mlansbury@despora.de
Mark Lansbury

UK's richest family get jail terms for exploiting staff

A Swiss court has sentenced four members of the wealthy Hinduja family to up to four years and six months in jail on Friday for exploiting their domestic workers.

Members of the family were accused of trafficking mostly-illiterate domestic workers from India, confiscating their passports, and forcing them to work 16-hour days in their Geneva villa without overtime pay.

https://www.dw.com/en/uks-richest-family-get-jail-terms-for-exploiting-staff/a-69442466

#WageSlave #slavery #wealthy #exploit #workers #domestic

2 Likes
1 Shares
5 Likes
4 Comments
1 Shares
salinger3@diaspora-fr.org
Salinger 3

Les alpinistes Charles Dubouloz et Symon Welfringer ouvrent une nouvelle voie en Himalaya

Les deux compagnons de cordée sont parvenus, samedi 18 mai, au sommet du Hungchi (7 029 m), à la frontière népalo-tibétaine, par la face ouest sur un itinéraire inédit.


La voie ouverte par Charles Dubouloz et Symon Welfringer sur la face ouest du #Hungchi

#Dubouloz et #Welfringer réalisent ainsi la première ascension en style alpin – un style léger, agile et rapide, sans porteurs, sans oxygène et sans cordes fixes – du Hungchi. Les dernières ascensions de ce sommet peu fréquenté, documentées par le site Himalayan Database qui recense depuis soixante ans toutes les expéditions au Népal, remontent au début des années 2000, quand des cordées japonaises et sud-coréenne étaient venues à bout, en style himalayen, de la face sud-ouest.

#montagne #alpinisme #escalade #glace #himalaya #exploit #france

3 Likes
2 Likes
1 Comments
anonymiss@despora.de
anonymiss

#CVE-2024-20356: #Jailbreaking a #Cisco appliance to run #DOOM

In this adventure, the Cisco #C195 device family was jailbroken in order to run unintended code. This includes the discovery of a vulnerability in the #CIMC body management controller which affects a range of different devices, whereby an authenticated high privilege user can obtain underlying root access to the server’s #BMC (CVE-2024-20356) which in itself has high-level access to various other components in the system. The end goal was to run DOOM – if a smart fridge can do it, why not Cisco?

source: https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom/

#software #security #bug #network #game #news #vulnerability #exploit #hack #hacker

CVE-2024-20356: Jailbreaking a Cisco appliance to run DOOM

The Cisco C195 is a Cisco Email Security Appliance device. Its role is to act as an SMTP gateway on your network perimeter. This device (and the full range of appliance devices) is heavily locked down and prevents unauthorised code from...

One person like that
anonymiss@despora.de
anonymiss

#LLM Agents can Autonomously #Exploit One-day Vulnerabilities

Source: https://arxiv.org/abs/2404.08144

To show this, we collected a dataset of 15 one-day vulnerabilities that include ones categorized as critical severity in the #CVE description. When given the CVE description, GPT-4 is capable of exploiting 87% of these vulnerabilities compared to 0% for every other model we test (GPT-3.5, open-source LLMs) and open-source vulnerability scanners (ZAP and #Metasploit).

#ai #technology #Software #chatgpt #bug #hack #news #cybersecurity

LLM Agents can Autonomously Exploit One-day Vulnerabilities

LLMs have becoming increasingly powerful, both in their benign and malicious uses. With the increase in capabilities, researchers have been increasingly interested in their ability to exploit cybersecurity vulnerabilities. In particular, recent...

4 Likes
brainwavelost@nerdpol.ch
brainwavelost

#Ukraine war cause and the end game explained: War of the globalist elite, #Blackrock, and bankers.

#Biden said.
Our goal is regime change.
Our goal is to get rid of #Putin, and our goal is ultimately to #divide #Russia into constituent parts, then #exploit it.
All of his supporters, his staffers, everyone in the globalist camp knows this is the truth.
The so-called oligarchs Kolomoisky, Soros and others were all part of this.
None of this is news.

https://twitter.com/ivan_8848/status/1773336445173829641

anonymiss@despora.de
anonymiss

#Microsoft #Security Breaches Rile U.S. #Government Customers

source: https://www.theinformation.com/articles/microsoft-security-breaches-rile-u-s-government-customers

Microsoft became the world’s biggest seller of cybersecurity software by bundling it with Office and Teams apps. But after a series of hacks exploited that software in the past year, several of Microsoft’s biggest customers are considering whether their reliance on Microsoft’s #software bundle puts their security at risk.

The clearest sign that Microsoft may face real consequences for its security lapses can be seen in #Washington. After the company disclosed last summer that Chinese hackers had broken into customers’ systems, including the U.S. State Department’s, the agency began to move its stored data into servers of other cloud providers such as #Amazon Web Services and #Google #Cloud, according to a technical adviser to the agency and an executive at one of the rival companies. And the agency has been discussing possible bigger cloud deals with those rivals, these people said.

#news #security #hack #hacker #exploit #cybersecurity #usa

4 Likes
3 Comments
2 Shares
2 Likes